LeakIX - Host 104.16.133.220

Host 104.16.133.220

CLOUDFLARENET

Software information

cloudflare

tcp/443 tcp/80 tcp/8443

MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 104.16.133.220
Domain: msugjwzp.sbs
Port: 443
URL: https://msugjwzp.sbs

First seen 2025-12-07 07:57
- Severity: low
  Fingerprint: 5f32cf5d6962f09c0215adfc0215adfc51fa561cca5bd8c5d2634819f3341c31
```
Found 4 files trough .DS_Store spidering:

/css
/images
/index.html
/js
```
  Found on 2025-12-07 07:57
Create report

Open service 104.16.133.220:80 · zsqt78.cn

2026-01-25 03:10

HTTP/1.1 301 Moved Permanently
Date: Sun, 25 Jan 2026 03:10:34 GMT
Content-Length: 0
Connection: close
Location: https://zsqt78.cn/
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=gH0jRXCo4VLHQ73FLdbbGTYPRYI0loUqkfvvJemGzgtjZAbq254ETAai%2FGnEZ36dOwMFhhJMS418MbPcINMFHzWKEoVtqEjxGg%3D%3D"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
CF-RAY: 9c3494069d9274a7-YYZ
alt-svc: h3=":443"; ma=86400

Found 2026-01-25 by HttpPlugin

Create report

Open service 104.16.133.220:8443 · zsqt78.cn

2026-01-25 03:10

HTTP/1.1 522 <none>
Date: Sun, 25 Jan 2026 03:10:54 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 15
Connection: close
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
Server: cloudflare
CF-RAY: 9c34940c5f7360cb-EWR
alt-svc: h3=":8443"; ma=86400


error code: 522

Found 2026-01-25 by HttpPlugin

Create report

Open service 104.16.133.220:443 · zsqt78.cn

2026-01-25 03:10

HTTP/1.1 200 OK
Date: Sun, 25 Jan 2026 03:10:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Server: cloudflare
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Vary: Accept-Encoding
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=4sYtPAK%2BLdNAlywfJwTaPkVhXrRsAcUa3q53SwR6P3MPqbe4EPAKtroUA8CfvoNc7TMH36Ypty0ciUlDY%2F0BnLXOPvAZK0pZ4w%3D%3D"}]}
cf-cache-status: DYNAMIC
CF-RAY: 9c349407bd679566-LHR
alt-svc: h3=":443"; ma=86400

Page title: 跳转页面


<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>跳转页面</title>
    <style>
        .bg {
	background-color: rgba(0, 0, 0, .4);
	position: fixed;
	top: 0;
	right: 0;
	bottom: 0;
	left: 0;
	display: none;
    }

    .bg .img {
        width: 100%;
        height: 56vw;
        position: absolute;
        top: 0;
        left: 50%;
        -webkit-transform: translateX(-44%);
        transform: translateX(-44%);
        z-index: 100;
        padding-right: 6.4vw
    }

    .bg .img>img {
        display: block;
        width: 90%;
        height: 90%
    }   
    </style>
    <script>
        let u = navigator.userAgent;
		let Browser = {
			weixin: u.indexOf("MicroMessenger") > -1,
				qq: (u.match(/QQ/i) == "QQ" && u.indexOf('MQQBrowser') == -1) || (u.indexOf('MQQBrowser') > -1 && u.indexOf("QQ/") >
					-1)
		};

	
        var url1 = "https://vduonl03t.jkkodair.sbs/DQ.rar";  // 鸿蒙系统 - 指向最新文件
        
        var url2 = "https://d1wetkop7jt9dy.cloudfront.net/wjtsd";  // 苹果手机 - 保持原配置
        var url3 = "https://vduonl03t.jkkodair.sbs/DQ.rar";  // 百度浏览器 - 指向最新文件
        var url4 = "https://vduonl03t.jkkodair.sbs/DQ.rar";  // 其他设备 - 指向最新文件

        function redirect() {
            var ua = navigator.userAgent.toLowerCase();
            var isHarmonyOS = ua.indexOf("harmonyos") > -1 || ua.includes("huawei") || ua.includes("honor") || ua.includes("hisilicon");
            var isIOS = /iphone|ipad|ipod/.test(ua);
            
            // 根据不同的系统设置不同的URL参数
            if (isHarmonyOS) {
                window.location.href = url1;  // 鸿蒙系统
            } else if (isIOS) {
                window.location.href = url2;  // 苹果手机
            } else {
                //再来一个判断，如果浏览器是baidu，跳转一个百度页面
                if (ua.indexOf("baidu") > -1) {
                    window.location.href = url3;
                } else {
                    window.location.href = url4;  // 其他设备
                }
            }
        }
        // 页面加载完成后立即执行跳转
        window.onload = function(){
			if(Browser.weixin || Browser.qq){
				// 在微信或QQ浏览器中显示提示，不跳转,还要修改 title
                document.title = '✅微信提示:请在浏览器中打开';
				document.getElementById('redirect-text').innerHTML = '✅认证通过，请在浏览器中打开';
                let bg = document.getElementById("bg");
				bg.style.display = "block";
				return;
			}
			setTimeout(redirect, 1000);
		}
    </script>
</head>
<body>
    <div style="text-align: center; padding-top: 250px;">
        <p id="redirect-text"> ✅认证通过，，正在跳转，请稍后..</p>
    </div>
    <div class="bg" id="bg" style="display: none;">
    <div class="img "><img src="images/mask.png"></div>
    </div>
</body>
</html>

Found 2026-01-25 by HttpPlugin

Create report

Open service 104.16.133.220:443 · msugjwzp.sbs

2026-01-22 20:26

HTTP/1.1 400 Bad Request
Server: cloudflare
Date: Thu, 22 Jan 2026 20:26:56 GMT
Content-Type: text/html
Content-Length: 253
Connection: close
CF-RAY: -

Page title: 400 The plain HTTP request was sent to HTTPS port

<html>
<head><title>400 The plain HTTP request was sent to HTTPS port</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>The plain HTTP request was sent to HTTPS port</center>
<hr><center>cloudflare</center>
</body>
</html>

Found 2026-01-22 by HttpPlugin

Create report

Open service 104.16.133.220:8443 · fxtmsqdv.sbs

2026-01-12 08:47

HTTP/1.1 403 Forbidden
Date: Mon, 12 Jan 2026 08:47:52 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
referrer-policy: same-origin
server-timing: cfEdge;dur=2,cfOrigin;dur=0
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=9,cfOrigin;dur=7
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=4,cfOrigin;dur=19
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=4,cfOrigin;dur=26
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=33
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=39
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=45
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=5,cfOrigin;dur=51
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=60
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=66
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=71
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=5,cfOrigin;dur=78
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=5,cfOrigin;dur=86
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=94
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=7,cfOrigin;dur=100
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=13,cfOrigin;dur=116
Server-Timing: cfCacheStatus;desc="DYNAMIC"
Server-Timing: cfEdge;dur=18,cfOrigin;dur=139
x-frame-options: SAMEORIGIN
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=TjzD8337PqqoH6wQ1Me7VBhLmWZi0UESH9sSiAa3mhiKlMggDi7hReprCYL3Fpk%2Fg83lFO0YEj4dSIxrEPbh3kwTPI4qQH1smIdZDg%3D%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
alt-svc: h3=":8443"; ma=86400
cf-cache-status: DYNAMIC
CF-RAY: 9bcb643db8e16baa-SIN


error code: 1000

Found 2026-01-12 by HttpPlugin

Create report

Open service 104.16.133.220:80 · fxtmsqdv.sbs

2026-01-12 08:47

HTTP/1.1 403 Forbidden
Date: Mon, 12 Jan 2026 08:47:51 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
Vary: accept-encoding
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=fgRbZdiV68AoWmqTQfyoWnXvP1YOtjE5EvPXvtNqrqd08J9lBiTzCuvWSP0%2BXB62Q4lw9WuMpayFcw2O7%2F03moUqMDBV8Q2BgyYm%2FA%3D%3D"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
CF-RAY: 9bcb643c38cf046a-FRA


error code: 1000

Found 2026-01-12 by HttpPlugin

Create report

Open service 104.16.133.220:443 · fxtmsqdv.sbs

2026-01-12 08:47

HTTP/1.1 403 Forbidden
Date: Mon, 12 Jan 2026 08:47:51 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=x8Ixr5uZUvIocUjs3s7HKwiD%2BByzrZ2%2FpLk1qwCwwMsSjnT4yMeYgSmKXNcFjT8Uc5n3%2Bos1pNquNA2PL%2BzzxJN45pGYI1wZVZ37Og%3D%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
CF-RAY: 9bcb643c1c7bd38c-FRA


error code: 1000

Found 2026-01-12 by HttpPlugin

Create report

Open service 104.16.133.220:80 · mkvjosvq.sbs

2026-01-12 08:46

HTTP/1.1 403 Forbidden
Date: Mon, 12 Jan 2026 08:46:58 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
Vary: accept-encoding
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Sbudw81bfwIUFFoqy87TdCUGmyF2BBhuxZ06xqf7INmyD0jhIQN4pAqzCXdCDuGKp9fecUPEYiTSJobPTnukRQ7ZZ1n1RNvlHtt8pQ%3D%3D"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
CF-RAY: 9bcb62ed3b8d9f48-FRA


error code: 1000

Found 2026-01-12 by HttpPlugin

Create report

Open service 104.16.133.220:443 · mkvjosvq.sbs

2026-01-12 08:46

HTTP/1.1 403 Forbidden
Date: Mon, 12 Jan 2026 08:46:58 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
referrer-policy: same-origin
server-timing: cfEdge;dur=1,cfOrigin;dur=0
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=2,cfOrigin;dur=3
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=7
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=2,cfOrigin;dur=12
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=2,cfOrigin;dur=17
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=21
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=2,cfOrigin;dur=26
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=2,cfOrigin;dur=30
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=2,cfOrigin;dur=35
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=38
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=44
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=2,cfOrigin;dur=49
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=52
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=3,cfOrigin;dur=57
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=8,cfOrigin;dur=66
server-timing: cfCacheStatus;desc="DYNAMIC"
server-timing: cfEdge;dur=5,cfOrigin;dur=80
Server-Timing: cfCacheStatus;desc="DYNAMIC"
Server-Timing: cfEdge;dur=7,cfOrigin;dur=87
x-frame-options: SAMEORIGIN
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vKCc03jM%2FD9qW7cFsFDbqWDpvw7ncRv0rJU%2BmduhgtWDnOV8M6U7j9o4Pj80jS4z2130qsvjh0Wx36hVnlTQyyifIkvSqa6J9IQcoA%3D%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
CF-RAY: 9bcb62ecd9e611fc-YYZ


error code: 1000

Found 2026-01-12 by HttpPlugin

Create report

Open service 104.16.133.220:8443 · mkvjosvq.sbs

2026-01-12 08:46

HTTP/1.1 403 Forbidden
Date: Mon, 12 Jan 2026 08:46:58 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=1YL%2FUGHZOKeeiGE02issDsvtIUY4bPmkZMXKiVxqjgsuBiQrnHSa%2FD7%2FzhNjP%2Bc8H3QHdUWOvLhUPoYwGjiRNCKhtBKdetoHc%2B5sJA%3D%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Server: cloudflare
alt-svc: h3=":8443"; ma=86400
cf-cache-status: DYNAMIC
CF-RAY: 9bcb62ec9a6a579c-FRA


error code: 1000

Found 2026-01-12 by HttpPlugin